mediumMultiple ChoiceObjective-mapped
SC-200 Practice Question: A SOC analyst wants to automate a response in…
A SOC analyst wants to automate a response in Microsoft Sentinel such that whenever an incident is created containing a specific user entity (e.g., compromised user), a playbook runs that disables the user in Microsoft Entra ID. Which condition should be configured in the automation rule?
⚠ Common exam trap
Candidates often confuse alert-level triggers (Option B) with incident-level triggers, or assume severity (Option C) is sufficient without considering entity-specific conditions, leading to over-triggering or missing the precise automation requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
When incident is created, and the incident contains a user entity.
The automation rule must trigger on incident creation and evaluate whether the incident contains a specific user entity to run the playbook that disables the user in Microsoft Entra ID. This ensures the playbook only executes when the relevant entity is present, aligning with the requirement to automate a response based on a compromised user entity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
When incident is created, and the incident contains a user entity.
Why this is correct
Automation rules in Microsoft Sentinel are evaluated when an incident is created, and they support conditions on incident properties and entity types. Selecting the trigger 'When incident is created' combined with a condition that the incident contains a User entity scopes the rule precisely, so the playbook runs automatically for every relevant incident. This is the correct way to automate a response because it directly matches the stated requirement of an incident-time trigger with a user entity filter.
- ✗
When alert is generated, and the alert contains a user entity.
Why it's wrong here
Alert generation occurs before an incident is created, and automation rules evaluate on incidents, not on raw alerts. While you can create automation rules that trigger on alert creation in some contexts, the entity condition referencing a 'user entity' is applied to the aggregated incident entities, not to each individual alert's entities. Triggering at the alert level would cause the playbook to run repeatedly for each generated alert and might act in the absence of a fully formed incident, so this option is incorrect.
- ✗
When incident is created with severity high, then run the playbook.
Why it's wrong here
Filtering only by high severity lacks the required entity condition entirely. A rule with this trigger and condition would execute for every high-severity incident, even when no user entity is present, causing the playbook to run on unrelated cases. The requirement specifically asks to respond when the incident contains a user entity, so severity alone is an insufficient and overly broad filter.
- ✗
When playbook is triggered manually from the incident details page.
Why it's wrong here
Manually launching a playbook from the incident details page requires a human to click the action, which fundamentally contradicts the goal of automated response. Automation rules are the mechanism for unattended execution, and they rely on predefined trigger conditions such as incident creation rather than on-demand user actions. Because this option depends on operator intervention, it does not fulfill the automation requirement.
Go deeper
Related to this question
About these practice questions
This SC-200 question is part of Courseiva's 209-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-200 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-200 exam.